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adaptation 

OF  PORTER’S 

FIVE  FORCES  MODEL 

TO  RISK  MANAGEMENT 

f  John  F.  Rice 

Prominent  tools  for  assessing  and  managing  risk  include  risk 
cubes,  risk  burndown  charts,  and  automated  risk  management 
software.  They  are  generally  lacking,  however,  in  accom¬ 
modating  ideation  and  brainstorming  to  identify  potential 
problems.  A  suggested  approach  for  improving  the  process 
is  to  apply  strategic  management  models  currently  used  as 
commercial  best  practices.  Many  are  directly  applicable  and 
adaptable  to  systems  engineering  processes  including  risk 
management.  This  article  presents  traditional  risk  tools  and 
introduces  a  complementary  management  model  tailored  to 
the  identification,  scoring,  and  tracking  of  potential  program 
threats.  Additional  management  models  are  presented  for 
further  investigation  and  adaptation. 
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In  this  article,  the  author  presents  typical  SE  models  such  as  the  work 
breakdown  structure,  functional  flow  block  diagram,  and  risk  cubes,  and 
explains  how  they  are  analogous  to  organizational  hierarchies,  enterprise 
flowcharts,  and  uncertainty  matrices,  respectively.  Particular  emphasis  is 
placed  on  risk  management  and  the  associated  adaptation  of  a  strategic 
management  model. 

The  linkage  between  strategic  organizational  management  and  systems 
engineering  has  been  observed  for  decades.  Management  theorists  have 
compared  corporate  organizations  to  “systems”  (Bertalanffy,  1956,  pp. 
1-10).  Optner  (1968)  described  organizational  systems  as  follows:  “A  system 
is  here  defined  as  a  set  of  objects  together  with  relationships  between  the 
objects  and  between  their  attributes  related  to  each  other  and  to  their 
environment  so  as  to  form  a  whole.” 

Jenkins’  (1974)  definition  of  a  system  is  a  complex  grouping  of  human 
beings  and  machines  for  which  there  is  an  overall  objective.  Expressed 
in  terms  of  systems  engineering  (SE),  Hall  (1962)  viewed  this  domain  as 
“operating  in  the  space  between  research  and  business,  assuming  the 
attitudes  of  both.” 


Traditional  Risk  Management 

Traditional  Risk  Management  (RM)  models  have  included  risk  cubes 
(Figure  1),  risk  burndown  charts  (Figure  2),  and  RM  software  applications 
such  as  Active  Risk  Manager,  Risk  Matrix,  and  Risk+  (DoD,  2009).  This  article 
addresses  the  adaptation  of  a  strategic  management  tool  to  model  risk  as 
part  of  a  structured  SE  process  (DoD,  2006).  By  tailoring  the  management 
tool  for  RM,  the  systems  engineer  has  another  “arrow  in  the  quiver”  to 
perform  the  risk  function  or  to  complement  existing  methods. 


FIGURE  1.  RISK  CUBE 
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FIGURE  2.  RISK  BURNDOWN  CHART 
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Five  Forces  Model 

The  strategic  management  model  and  focal  point  of  this  article 
is  known  as  the  Five  Forces  Model  (Barney,  1996,  p.  6).  Its  originator, 
Dr.  Michael  Porter,  University  Professor  at  Harvard  Business  School, 
developed  the  tool  for  competitive  advantage  analysis  within  specific 
industries.  (Other  management  tools  adaptable  to  RM/SE  functions  are 
described  in  subsequent  discussion  on  “Additional  Models.”) 

As  shown  in  Figure  3,  the  center  block  depicts  intensity  of  rivalry 
among  industry  competitors.  The  external  forces— new  entrants, 
bargaining  power  of  buyers  and  suppliers,  and  substitutes— are  shown 
as  the  threats  acting  on  the  industry. 


FIGURE  3.  PORTER’S  FIVE  FORCES  MODEL 
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The  purpose  of  developing  a  model  of  environmental  threats  is  to  aid 
managers  in  evaluating  these  threats  so  they  can  become  more  successful 
in  creating  strategies  to  neutralize  them.  Porter  and  Millar  (1985)  contend 
the  five  characteristics  of  corporate  structure  can  threaten  the  ability  of  an 
organization  to  either  preserve  or  produce  above-normal  returns. 

Adaptation  to  Risk  Management 

Adapting  the  Five  Forces  Model  to  RM  involves  replacing  intra-industry 
rivalries  and  competitive  threats  with  the  following  risk  forces  (a.k.a.  the 
five  /'s): 

•  internal  organization 

•  Industry 

•  information 

•  Infrastructure 

•  influences 

For  discussion  purposes,  these  forces  are  stated  in  the  current  tense. 
Actual  risks  would  be  stated  in  the  future  tense  with  root  causes,  and 
probabilities  and  consequences. 

Internal  organization  risks  include  enterprise  functions  such  as 
task  sharing,  personnel  loads,  cross  training,  assignment  duration,  and 
related  parameters.  Industry  risks  are  associated  with  contractor  and 
subcontractor  organizations,  technology  maturity,  product  support,  and 
contractual  matters. 

Information  risks  include  software  availability  and  functionality, 
information  system  backup,  and  network  security.  Infrastructure  refers 
to  physical  security,  communications  networks,  event  recovery,  and 
safety.  Influences  include  external  demands  (e.g.,  meetings,  travel),  senior 
leadership  support,  and  policy  mandates. 

It  should  be  noted  that  the  tailoring  of  Porter’s  model  to  a  program-level 
effort  involves  more  than  a  change  in  nomenclature.  It  requires  a  change  of 
perspective  from  an  industry  view  to  an  enterprise  view.  Additionally,  the 
forces  are  no  longer  competitive  in  nature,  but  risk-related. 

The  RM  version  of  the  Five  Forces  Model,  hereafter  called  RM5,  has 
numerous  benefits,  including  the  ability  to: 

•  Perform  back-of-the-envelope  cursory  analyses 

•  Promote  and  capture  brainstorming  among  groups 

•  Document  the  identification  of  potential  risks  from  the 
brainstorming  session 

•  Categorize  the  risks  into  one  of  the  five  I’s 
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•  Measure  the  impact  of  each  risk  using  a  consensus  scoring 
approach 

•  Track  risk  trends  through  comparison  of  RM5  iterations. 

As  a  consequence,  it  can  be  shown  all  categories  have  some  degree  of 
risk,  and  those  items  could  be  targeted  for  mitigation.  The  risks  for  either 
approach  could  be  weighted  to  underscore  their  importance. 


Practical  Application 

The  author  initially  utilized  RM5  in  2004  to  assess  risk  in  the  U.S.  Army’s 
Armed  Reconnaissance  Helicopter  (ARM)  Product  Office— specifically,  while 
serving  on  the  proposal  evaluation  team.  As  shown  in  Figure  4,  each  of 
the  five  I’s  was  examined  for  candidate  risks  such  as  contractor  (Industry), 
communications  (Information),  budget  (Influences),  personnel  (Internal), 
and  system  risks  (Infrastructure). 

The  identification  of  risks  was  generated  from  subject  matter  experts, 
experienced  systems  engineers,  and  brainstorming  sessions.  Initially,  some 
of  the  submitted  risks  were  of  low  significance  or  relevance.  Through 
iterative  reviews,  the  candidates  were  promoted  or  demoted  to  validate 
their  importance. 


FIGURE  4.  RM5  MODEL 
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Scoring  and  weighting  of  risks  are  also  features  of  RM5.  Scoring  is 
performed  in  a  manner  similar  to  Porter's  model  where  +,  0,  and  -  are  used 
to  indicate  a  positive,  neutral,  or  negative  condition.  In  risk  terminology, 
this  is  stated  as  a  positive  trend,  unlikely/unknown  risk,  or  negative  trend. 

Weighting  can  be  applied  by  assigning  multiple  notations  (e.g.,  +  +) 
based  on  consensus  or  expertise,  or  through  numerical  methods  such 
as  regression  analysis.  Using  historical  run  data,  a  trend  analysis  can  be 
performed  and  plotted  as  curves,  Gantt  charts,  or  similar  illustrations. 

Results  from  ARH 

When  initially  applied  to  ARH  as  a  brainstorming  effort,  several  risks 
were  identified  beyond  the  cost  and  schedule  constraints  formally  tracked 
by  the  Product  Office.  Certainly  a  Product  Office’s  risk  management 
resources  are  limited,  and  not  all  risks  can  or  should  be  tracked.  However, 
the  time  and  effort  to  apply  RMS  and  identify  other  significant  risks  proved 
valuable. 

The  results  of  this  initial  run  yielded  the  following  example  risks  not 
tracked  by  the  Product  Office: 

•  Market  research  was  indicating  COTS/MOTS  (commercial  off- 
the-shelf/modified  COTS)  technical  maturity  might  be  lower 
than  originally  assessed.  This  raised  the  likelihood  of  future, 
unplanned  subsystem  development  with  the  consequence  of 
depleted  resources. 

•  Substitute  technologies  and  platforms  were  lacking.  The 
likelihood  of  a  gap  in  fielded  capabilities  was  evident,  with  the 
consequence  of  compromised  operational  missions. 

•  Enterprise  Communications  Systems  for  the  proposal 
evaluation  team  were  limited  compared  to  typical  office 
systems  with  e-mail  and  instant  messaging.  This  raised  the 
likelihood  that  critical  information  during  proposal  assessment 
could  remain  isolated,  with  the  consequence  of  unreported 
risks  or  opportunities. 

During  subsequent  runs,  these  risks  remained  notable,  and  additional 
RMS  risks  proved  to  be  consequential: 

•  Physical  security,  originally  assessed  as  positive,  was 
compromised  during  the  proposal  evaluation  period. 

An  individual  in  the  team’s  facility  lacked  credentials 
and  authorization,  and  was  immediately  escorted  from 
the  facility. 
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•  Assignment  duration  was  more  than  twice  as  long  as  planned, 
with  detrimental  effects  on  matrixed  personnel.  Engineers 
reported  inability  to  complete  their  functional  office  tasks 
resulting  in  “other  program”  delays. 

RM5  Validity 

The  ARH  contract  was  awarded  in  2006  to  Bell  Helicopter.  The  contract 
later  experienced  a  Nunn-McCurdy  breach  for  significant  cost  overages. 
It  was  acknowledged  by  the  Government  Accountability  Office  (GAO, 
2008,  p.  43)  that  the  inclusion  of  immature  COTS  technologies  resulted  in 
significant,  unplanned  development  funding  and  schedule  delays.  It  was 
also  noted  that  this  program’s  shortcomings  have  left  a  void  in  the  Army’s 
ability  to  perform  armed  reconnaissance.  Excessive  delays  and  growth  in 
program  costs  forced  the  ARH  program’s  cancellation  on  October  16,  2008, 
when  the  Department  of  Defense  failed  to  certify  the  program  to  Congress. 

Negative  consequences  from  the  physical  security  breach, 
communication  system  inadequacies,  and  other  noted  RM5  risks  could 
have  been  avoided  had  RM5  been  formalized.  However,  the  method  was 
novel  and  nonstandard,  impeding  its  adoption  in  the  Product  Office.  ARH 
subsequently  experienced  a  Nunn-McCurdy  breach  as  a  result  of  technical 
challenges  and  cost  overruns  associated  with  many  of  the  RM5  risks.  The 
author  contends  a  more  formal  treatment  of  RM5  would  have  uncovered 
and  highlighted  several  “show-stopping”  risks. 

Other  Model  Uses 

Other  uses  for  the  model  include  applying  it  specifically  to  identification 
of  existing,  rather  than  projected,  program  issues.  This  could  provide 
managers  a  snapshot  of  information  that  would  otherwise  escape  attention 
and  provide  them  with  the  insight  to  head  off  problems.  Likewise,  RM5 
could  be  used  to  identify  strengths  or  opportunities  that  were  previously 
unrecognized  and  could  support  or  provide  visibility  to  a  program. 

In  all  of  the  above  cases,  the  potential  for  cost  savings  or  revenue 
generation  is  apparent  since  reducing  risks  or  capturing  opportunities  are 
means  to  improving  the  bottom  line. 

Furthermore,  having  a  model  to  complement  existing  SE  tools  provides 
an  additional  decision  aid  to  validate  current  assumptions  or  to  promote 
ideation  for  new  process/product  development. 
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Additional  Models 

Other  management  tools  adaptable  to  RM  or  SE  functions  include,  but 
are  not  limited  to: 

•  Strengths,  Weaknesses,  Opportunities,  and  Threats  (SWOT) 
analysis  for  requirements  development 

•  Gap  analysis  for  trade  studies  (Robbins  &  Coulter,  1996,  pp. 
264-265) 

•  Value  Chain  analysis  for  determining  value  added  from 
technical  processes  (Crawford,  1997,  pp.  480-481). 


SWOT  ANALYSIS 

SWOT  analysis  (Figure  5)  can  be  performed  by  compiling  a  list  of 
organizational  attributes  applied  to  each  of  these  categories.  This  allows 
management  to  determine  where  resources  need  to  be  allocated  to  either 
shore  up  or  scale  back  attributes  to  optimize  program  performance. 


FIGURE  5.  SWOT  ANALYSIS 
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GAP  ANALYSIS 

A  gap  map  (Figure  6)  employs  a  two-axis,  four-quadrant  graphic 
depicting  variables  of  interest  to  the  systems  engineer.  Variables  could  be 
metrics  relating  to  cost,  schedule,  and  performance,  for  example;  however, 
the  axes  are  not  restricted  to  specific  categories.  The  systems  engineer 
determines  what  is  of  value  or  interest. 

The  space  is  populated  to  show  occurrences  of  the  variables  or  lack 
thereof.  Should  a  particular  quadrant,  for  example,  be  void  of  data  points, 
this  could  be  an  indication  of  an  opportunity  or  perhaps  a  deficiency 
in  the  enterprise.  To  demonstrate  the  scale  of  an  occurrence,  symbols 
(e.g.,  circle)  are  sized  accordingly.  For  instance,  if  many  COTS  systems 
were  identified  in  a  quadrant,  the  size  of  the  symbol  would  be  indicative. 
Conversely,  few  occurrences  would  be  represented  as  a  small  symbol. 
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FIGURE  6.  GAP  MAP 
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Finally,  an  opportunity  or  deficiency  could  be  shown  as  a  dashed,  unfilled 
symbol— scaled  to  show  the  magnitude  of  the  gap. 


VALUE  CHAIN  ANALYSIS 

The  value  chain  (Figure  7)  is  comprised  of  the  functions  performed 
to  create  a  product  or  service.  A  margin  is  depicted  to  highlight  the  value 
added  for  the  customer.  This  would  be  a  useful  model  for  trade  studies 
to  represent  alternative  approaches  and  determine  which  produces  the 
greatest  margin  or  best  value. 


FIGURE  7.  VALUE  CHAIN 
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The  elements  of  the  value  chain  are  defined  as  follows: 


Firm  infrastructure— Support  of  entire  value  chain,  such  as  general 
management,  planning,  finance,  accounting,  legal  services, 
government  affairs,  and  quality  management 

Human  resource  management— Recruiting,  hiring,  training,  and 
development 

Technology  development— Improving  product  and  manufacturing 
process 

Procurement— Function  or  purchasing  input 

Inbound  logistics— Materials  receiving,  storing,  and  distribution  to 
manufacturing  premises 

Operations— Transforming  inputs  into  finished  products 

Outbound  logistics— Storing  and  distributing  products 

Marketing  and  sales— Promotion  and  sales  force 

Service— Service  to  maintain  or  enhance  product  value  (Crawford, 
1997) 

Conclusions 

The  multidisciplinary  aspects  of  strategic  management  tools  lend 
themselves  to  other  uses.  This  article  focused  on  one  tool  to  present  this 
approach  as  it  pertains  to  RM.  However,  it  is  apparent  from  the  other  models 
presented  that  the  overlap  between  strategic  management  and  SE  yields 
opportunities  for  similar  analyses  (della  Cava,  2009).  Opportunities  exist 
to  extend  this  approach  to  broad  SE  disciplines  or  focus  the  model  on 
specialty  domains.  Examples  include  technology  readiness,  information 
assurance,  and  environmental  considerations. 
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